Skip to content

Commit aa5cb70

Browse files
committed
ci: Update release workflow for npm OIDC authentication
1 parent 2262d83 commit aa5cb70

File tree

1 file changed

+12
-1
lines changed

1 file changed

+12
-1
lines changed

.github/workflows/release.yml

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,13 +67,20 @@ jobs:
6767
- build-and-test
6868
- create-release-branch
6969
- confirm-public-repo-master-branch
70+
71+
# OIDC permissions for npm trusted publishing
72+
permissions:
73+
contents: write # For pushing commits and tags
74+
issues: write # For semantic-release to comment on issues
75+
pull-requests: write # For semantic-release to comment on PRs
76+
id-token: write # Required for OIDC authentication with npm
77+
7078
env:
7179
GITHUB_TOKEN: ${{ secrets.MP_INTEGRATIONS_SEMANTIC_RELEASE_BOT }}
7280
GIT_AUTHOR_NAME: mparticle-automation
7381
GIT_AUTHOR_EMAIL: developers@mparticle.com
7482
GIT_COMMITTER_NAME: mparticle-automation
7583
GIT_COMMITTER_EMAIL: developers@mparticle.com
76-
NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
7784

7885
steps:
7986
- name: Checkout public master branch
@@ -97,9 +104,13 @@ jobs:
97104
uses: actions/setup-node@v4
98105
with:
99106
node-version: 24.x
107+
registry-url: 'https://registry.npmjs.org'
100108

101109
- name: Install dependencies
102110
run: npm ci
111+
112+
- name: Ensure npm CLI supports OIDC
113+
run: npm install -g npm@latest
103114

104115
- name: Release --dry-run
105116
if: ${{ github.event.inputs.dryRun == 'true'}}

0 commit comments

Comments
 (0)